Since data traffic transmitted over networks is steadily growing, traffic monitoring is becoming increasingly important for network suppliers and network operators in order to determine the so-called quality of service (QoS) within the network. There are principally two ways for determining the QoS in a network by means of traffic monitoring.
One way is to perform traffic measurements at a user terminal. User terminals specially designed for providing traffic measurement functions can be used for such measurements. For example, the TEMS mobile terminals from Ericsson are designed for monitoring service and network performance remotely at the terminal. Such terminals enable network suppliers and network operators to measure end-user perceived quality.
Another possibility is to perform passive measurements within the network. Passive measurement means that network traffic is captured at certain interfaces within the network. Performance indicators indicative of the QoS are obtained by processing the captured network traffic. In case of passive measurements, end-user perceived quality is approximated by means of the performance indicators.
U.S. Pat. No. 6,807,156 B1 concerns a method and a system of identifying and determining degradation of the QoS perceived by a subscriber in a network. Traffic of individual applications of the subscriber and aggregated traffic of a subscriber are monitored, captured and processed to produce QoS statistics.
Although end-user perceived performance may best be observed at a mobile terminal, the approach of passive measurements in the network still has a plurality of advantages over measurements at the user terminal.
In particular, no specifically designed user terminals are needed, all user terminals in a live network can be observed, and cost-efficient, large-scale monitoring is possible because a limited number of measurement points can cover a large part of a network. Furthermore, by means of passive measurements, not only end-user perceived performance can be observed, but also traffic composition and volume. In particular, the most popular applications and traffic demands of typical users or power users can be determined. Another advantage of passive measurements is that faults can be localized, and the cause of performance degradations, i.e. bottlenecks, within the network can be found.
Due to the above described advantages, passive traffic monitoring based on performance, fault-analysis and traffic modelling is becoming an increasingly important part of network audit and management services. However, existing and proposed passive traffic monitoring solutions have a plurality of drawbacks.
One solution for passive measurements captures all traffic at a single monitoring point. Since the prices for network access and network services decrease, the number of subscribers which are using network applications having a high bandwidth requirement is increasing. Therefore, if all traffic is captured at a single monitoring point, i.e. at a certain network interface, a huge amount of traffic may need to be captured within a short period of time. However, it is difficult to handle and process such a huge amount of captured traffic. In case too much traffic would be captured, measurement intervals will have to be shortened. Such a shortening of the traffic monitoring intervals provides the disadvantage that certain types of events, for example subscribers attaching to the network or handovers, which are too rare events, will not produce a statistically reliable sample set. Furthermore, long-term statistics like daily profiles cannot be provided.
Other passive measurement solutions have been proposed in which traffic is filtered and processed in real time during capturing. However, such a real time filtering and processing faces the problem of fulfilling the real time transmission requirements. Data transfer rates of monitored links can be in the order of several Giga bit per second (Gbps). Furthermore, the utilization of such links constantly increases. Even when special hardware for traffic filtering and processing is incorporated at a monitoring point, real time filtering and processing algorithms will soon reach real time limits.
Moreover, in order to provide user-oriented performance measurements, for example end-to-end packet delay or call setup delay, signalling and data traffic of a subscriber has to be monitored at two or more monitoring points within the network. Such a user tracking at two or more monitoring points requires a harmonization of the monitoring at the measurement points. Harmonization may be based on International Mobile Subscriber Identities (IMSI), which exactly identifies each subscriber. However, the IMSI is not available in every network node and during each signalling phase. Furthermore, the IMSI is not present in each data packet of a subscriber. Thus, for traffic monitoring at two or more monitoring points, the monitoring points have to maintain a mapping table and have to perform a table look-up for each data packet passing a certain network node. Since data packets are passing the network nodes with data transfer rates of several Gbps, such table look-up requires sophisticated hardware and a huge amount of processing power.
A solution of this problem could be the use of real time signalling of filtering information between monitoring points. However, strict delay requirements between the monitoring points would have to be fulfilled. Also, such real time signalling consumes processing power which cannot be spent for traffic monitoring.